Signal Governing Luminaries: The Global Cyber War Hits Home

Summary

The target of the confirmed Volt Typhoon intrusion was the Littleton Electric Light and Water Departments (LELWD), which serves Littleton and Boxborough, Massachusetts, with a combined population of about 15,000. LELWD's assistant general manager received a call from the FBI in late November 2023 alerting the utility that it was one of roughly 200 US critical-infrastructure entities victimized by the China-linked Volt Typhoon network, and FBI agents and CISA representatives arrived the following Monday to assist the investigation. Volt Typhoon had actually compromised LELWD's systems in February 2023, meaning the intrusion went undetected for more than 300 days until discovery in November 2023. Initial access came through a known, unpatched vulnerability in a FortiGate 300D firewall that had not been updated since December 2022, after which the actors used legitimate credentials and native tools to move laterally across IT and OT networks, collecting grid schematics and control-system procedures. No service outage or customer-data compromise resulted, and Dragos, brought in as the OT security provider, helped remove the hackers during an expedited response in November 2023; the intrusion is assessed as part of a broader Chinese pre-positioning effort intended to enable destructive action in a future conflict.